CVE-2024-54189
📋 TL;DR
A privilege escalation vulnerability in Parallels Desktop for Mac allows attackers to write to arbitrary files by exploiting hard links during snapshot creation. This could enable local attackers to gain root privileges on the host system. Only users running the affected version of Parallels Desktop on macOS are impacted.
💻 Affected Systems
- Parallels Desktop for Mac
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise of the macOS host system, allowing complete control over the machine and all virtual machines.
Likely Case
Local privilege escalation from a standard user to root on the macOS host, enabling installation of persistent malware or access to sensitive data.
If Mitigated
Limited impact if proper access controls and monitoring are in place, potentially detected before full exploitation.
🎯 Exploit Status
Requires local access and knowledge of the snapshot process timing. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version (beyond 20.1.1 build 55740)
Vendor Advisory: https://kb.parallels.com/en/130010
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Parallels Desktop menu > Check for Updates. 3. Install available updates. 4. Restart Parallels Desktop and affected virtual machines.
🔧 Temporary Workarounds
Disable snapshot functionality
allTemporarily disable the snapshot feature to prevent exploitation
Restrict user access
allLimit Parallels Desktop access to trusted users only
🧯 If You Can't Patch
- Restrict Parallels Desktop to trusted users only
- Monitor for unusual file system activity and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version in About Parallels Desktop. If version is 20.1.1 (build 55740), system is vulnerable.Check Version:
Open Parallels Desktop > Parallels Desktop menu > About Parallels DesktopVerify Fix Applied:
Verify version is updated beyond 20.1.1 build 55740 in About Parallels Desktop.📡 Detection & Monitoring
Log Indicators:
- Unusual file writes during snapshot operations
- Privilege escalation attempts in system logs
Network Indicators:
- None - local attack only
SIEM Query:
Search for process elevation from parallels processes or unusual file system modifications by parallels services